Skip to content

Add lsquic_conn_get_full_cert_chain to obtain certs including leaf on server side - #581

Merged
dtikhonov merged 2 commits into
litespeedtech:comb-pr-581from
richard-ramos:full-cert-chain
Sep 6, 2026
Merged

dtikhonov merged 2 commits into
litespeedtech:comb-pr-581from
richard-ramos:full-cert-chain

Conversation

@richard-ramos

Copy link
Copy Markdown
Contributor

Adds an additional function to the API: lsquic_conn_get_full_cert_chain, which can be used when you want the client to send a certificate, and then perform a custom validation over the certificate sent by the client.

The reason behind why this function is necessary is because lsquic_conn_get_server_cert_chain will return the cert chain excluding the leaf when called from the server, and if the client is using a self signed certificate, the cert will just no appear there.

@dtikhonov

Copy link
Copy Markdown
Collaborator

Thank you for PR! Any chance you could add this call to bin/http_server.c? (It's fine if the answer is "no," but that will make this PR slower to merge, because then I will add this code to test...)

@richard-ramos

Copy link
Copy Markdown
Contributor Author

Sure! I'll update the PR today/tomorrow. Thank you!

@richard-ramos

Copy link
Copy Markdown
Contributor Author

@dtikhonov done!
took a while, but i added the call to http_server.c

@dtikhonov

Copy link
Copy Markdown
Collaborator

Thank you, @richard-ramos! This will likely make it into the next minor release (4.10).

@dtikhonov
dtikhonov changed the base branch from master to comb-pr-581 September 6, 2026 01:54
@dtikhonov
dtikhonov merged commit f138b2e into litespeedtech:comb-pr-581 Sep 6, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants